Abstract:As deep neural networks (DNNs) are widely applied in the physical world, many researches are focusing on physical-world adversarial examples (PAEs), which introduce perturbations to inputs and cause the model's incorrect outputs. However, existing PAEs face two challenges: unsatisfactory attack performance (i.e., poor transferability and insufficient robustness to environment conditions), and difficulty in balancing attack effectiveness with stealthiness, where better attack effectiveness often makes PAEs more perceptible. In this paper, we explore a novel perturbation-based method to overcome the challenges. For the first challenge, we introduce a strategy Deceptive RF injection based on robust features (RFs) that are predictive, robust to perturbations, and consistent across different models. Specifically, it improves the transferability and robustness of PAEs by covering RFs of other classes onto the predictive features in clean images. For the second challenge, we introduce another strategy Adversarial Semantic Pattern Minimization, which removes most perturbations and retains only essential adversarial patterns in AEsBased on the two strategies, we design our method Robust Feature Coverage Attack (RFCoA), comprising Robust Feature Disentanglement and Adversarial Feature Fusion. In the first stage, we extract target class RFs in feature space. In the second stage, we use attention-based feature fusion to overlay these RFs onto predictive features of clean images and remove unnecessary perturbations. Experiments show our method's superior transferability, robustness, and stealthiness compared to existing state-of-the-art methods. Additionally, our method's effectiveness can extend to Large Vision-Language Models (LVLMs), indicating its potential applicability to more complex tasks.

Enhancing Adversarial Transferability in Object Detection with Bidirectional Feature Distortion.

Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion

Playing Against Deep-Neural-Network-Based Object Detectors: A Novel Bidirectional Adversarial Attack Approach

Object-Aware Transfer-Based Black-Box Adversarial Attack on Object Detector.

FDAA: A feature distribution-aware transferable adversarial attack method

Fooling Aerial Detectors by Background Attack via Dual-Adversarial-Induced Error Identification

Improving the Transferability of Adversarial Attacks on Face Recognition With Beneficial Perturbation Feature Augmentation

ADVERSARIAL ATTACKS ON OBJECT DETECTORS WITH LIMITED PERTURBATIONS

Transferable Physical Attack against Object Detection with Separable Attention

Improving Transferability for Domain Adaptive Detection Transformers

Toward Enhanced Adversarial Robustness Generalization in Object Detection: Feature Disentangled Domain Adaptation for Adversarial Training

Adversarial Defense Teacher for Cross-Domain Object Detection under Poor Visibility Conditions

Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors.

Blurred-Dilated Method for Adversarial Attacks.

Diversifying the High-level Features for better Adversarial Transferability

Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature

DPatch: An Adversarial Patch Attack on Object Detectors

Enhancing Infrared Small Target Detection Robustness with Bi-Level Adversarial Framework

Improving Adversarial Transferability by Stable Diffusion

Mitigating Adversarial Attacks in Object Detection through Conditional Diffusion Models